joewein.de LLC
Fighting spam and scams
on the Internet

Home / Blog / About us
Spam
419/Nigeria
Online fraud
jwSpamSpy
Contact

Email Spam Filter:
jwSpamSpy
Try it for free!

Google
 

Fraudulent Job offer: Advertising International Company (AIC)

The "Advertising International Company" job offer is part of a series of scams designed to trick third parties into assisting the criminal laundering of stolen money. It has similarities to the alpenantique.com spam.

See more about this type of scam here:

Here is the message:

Advertising International Company
More than 7 years of successful working in the market of advertising services



Looking for a perspective and well-paid job
in the Germany?
1. If you are looking for a perspective and well-paid work in the Germany (of more than 1000 $ in a week guaranteed).

2. If you are a resident of the Germany (Obligatory condition).

3. If you are over 18 (Obligatory condition).

Check up our site for the further information
Click here (once)


Here are the message headers:

Received: from 217.252.115.9 (HELO pD9FC7309.dip.t-dialin.net) (217.252.115.9)
  by mta120.mail.dcn.yahoo.com with SMTP; Tue, 16 Nov 2004 12:26:09 -0800
Received: from a-i-c-d.org (mail.a-i-c-d.org [222.223.128.38])
  by pD9FC7309.dip.t-dialin.net (Postfix) with ESMTP id 6EFEFEEDC0
  for <ourname@ourdomain>; Tue, 16 Nov 2004 16:23:22 -0500
Reply-To:
From: "Caroms R. Svelter" <aichner@a-i-c-d.org>
To: Ourname <ourname@ourdomain>
Subject: FREE Work from Home ! lFAKTQv3ptNgAh
Date: Tue, 16 Nov 2004 16:23:22 -0500
Message-ID: <110001c4cc22$0b388789$b881f0dd@a-i-c-d.org>
MIME-Version: 1.0
Content-Type: text/html
Content-Transfer-Encoding: quoted-printable
X-Priority: 3 (Normal)
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook, Build 10.0.2616
Importance: Normal
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1082
X-AntiVirus: skaner antywirusowy poczty Wirtualnej Polski S. A.

Notes:

  • Why is this job offer sent to a total stranger about whom the company knows nothing?
  • Why is the mail sent directly from a dialup address using "ratware" (special spam sending software that claims it's Outlook Express?
  • Why is there no postal address, telephone number of fax number in the email?
  • The company's domain (a-i-c-d.org) was only registered 17 days ago (2004-10-30), two days after the lionder.org fake job offer website. That's a bit recent for a seven year old company.
  • The registration details from the WHOIS record are completely phony.

AICD.org is a fraud!

This is a similar scam to the "Plasma project, Inc.", "Alpen-Antique GmbH" and Lionder.org job scams.

As we recently found out, the objective of the "Alpen-Antique GmbH" fraud was to trick people into making money stolen from hacked bank accounts untraceable by receiving it in their own account, withdrawing it in cash and then forwarding it via Western Union. Most likely, "AIC" will steal money from hacked German bank accounts in the near future and is looking for people to unwittingly assist them. Quite possibly organized crime from Eastern Europe is behind this scam: Lionder.org posed as a Lithuanian company, "Alpen-Antique GmbH" supplied an Estonian name for the wire transfer recipient and "AIC" claims to run billboards in Russia.

As with the "Plasma project, Inc." and "Alpen-Antique GmbH" scams, the fraudulent website is based on the site of a legitimate company. The fraudulent website keeps getting recycled under new names. In this case, the original legitimate company is Lamar Advertising Company in the US.

Compare the original:

Currently, Lamar operates more than 149,000 billboards and more than 97,500 logo sign displays across the country. In addition, Lamar has 40 transit advertising franchises that reach driving audiences in 16 states through displays on bus shelters, benches and buses.
http://www.arbitron.com/newsroom/archive/01_20_04.htm

with these rip-offs:

Currently, MAIC operates more than 147,000 billboards and more than 90,000 logo sign displays across the country. In addition, MAIC has 40 transit advertising franchises that reach driving audiences in 16 states through displays on bus shelters, benches and buses.
(formerly at http://www.morsadvertising.com/about.html)

Currently, DTC operates more than 147,000 billboards and more than 90,000 logo sign displays across the country. In addition, DTC has 40 transit advertising franchises that reach driving audiences in 16 states through displays on bus shelters, benches and buses.
(formerly at http://dtc-usa.com/)

Currently, AIC operates more than 147,000 billboards and more than 90,000 logo sign displays across the country. In addition, AIC has 40 transit advertising franchises that reach driving audiences in 16 states through displays on bus shelters, benches and buses.
(currently at http://www.a-i-c-d.org/)

WHOIS record for a-i-c-d.org

     Domain ID:D105067383-LROR
     Domain Name:A-I-C-D.ORG
     Created On:30-Oct-2004 19:07:40 UTC
     Last Updated On:30-Oct-2004 19:08:41 UTC
     Expiration Date:30-Oct-2005 19:07:40 UTC
     Sponsoring Registrar:Bizcn.com, Inc. (R1248-LROR)
     Status:TRANSFER PROHIBITED
     Registrant ID:orggg99163262238
     Registrant Name:guo guo
     Registrant Organization:guo
     Registrant Street1:Shanghai China
     Registrant Street2:
     Registrant Street3:
     Registrant City:Shang Hai
     Registrant State/Province:Shang Hai
     Registrant Postal Code:200001
     Registrant Country:CN
     Registrant Phone:+86.59222222222
     Registrant Phone Ext.:
     Registrant FAX:+86.59222222222
     Registrant FAX Ext.:
     Registrant Email:112244@126.com
     Admin ID:orggg99163262575
     Admin Name:guo guo
     Admin Organization:guo
     Admin Street1:Shanghai China
     Admin Street2:
     Admin Street3:
     Admin City:Shang Hai
     Admin State/Province:Shang Hai
     Admin Postal Code:200001
     Admin Country:CN
     Admin Phone:+86.59222222222
     Admin Phone Ext.:
     Admin FAX:+86.59222222222
     Admin FAX Ext.:
     Admin Email:112244@126.com
     Tech ID:orggg99163262888
     Tech Name:guo guo
     Tech Organization:guo guo
     Tech Street1:Shanghai China
     Tech Street2:
     Tech Street3:
     Tech City:Shang Hai
     Tech State/Province:Shang Hai
     Tech Postal Code:200001
     Tech Country:CN
     Tech Phone:+86.59222222222
     Tech Phone Ext.:
     Tech FAX:+86.59222222222
     Tech FAX Ext.:
     Tech Email:112244@126.com
     Name Server:NS1.ROTDNS.BIZ
     Name Server:NS2.ROTDNS.BIZ
 


"Advertising International Company (AIC) continued: a-i-k.com
"a-i-k.com" uses the same website as the "a-i-c-d.org" scam, but a different domain. It looks like the criminals will be targetting accounts at several Spanish banks:

Perspective work in Spain for all comers to have good money!
Our company requires employees able to receive our clients' remittances in Spain . For doing it you should open an account at one of the following banks: www.cajamadrid.es, www.kutxa.es, www.cajamar.es, www.banesto.es and inform us the account data.
After that our clients make remittances to your account. You get the money and send them by Western Union to our company (you'll be informed of the account data after the transmission)
What's your profit? You will get 7% commission from each remittance. Since all remittances will be about eur.3500, your profit will be up to eur.250.

WHOIS details for domain "a-i-k.com"

  Domain Name: a-i-k.com

   Registrant Contact:
      Martha Poyatos         an1555672@hotmail.com
      Martha Poyatos
      735 -17th Avenue
      Menlo Park, CA 94025
      US
      +1.6503277451

   Administrative Contact:
      Martha Poyatos         an1555672@hotmail.com
      Martha Poyatos
      735 -17th Avenue
      Menlo Park, CA 94025
      US
      +1.6503277451

   Technical Contact:
      Martha Poyatos         an1555672@hotmail.com
      Martha Poyatos
      735 -17th Avenue
      Menlo Park, CA 94025
      US
      +1.6503277451

   Billing Contact:
      Martha Poyatos         an1555672@hotmail.com
      Martha Poyatos
      735 -17th Avenue
      Menlo Park, CA 94025
      US
      +1.6503277451

   Record created on 2005-02-04 15:53:19.
   Record expires on 2006-02-04 15:53:19.

   Domain servers in listed order:

      ns1.vhosted.biz
      ns2.vhosted.biz


Anti-Spam Resources:
jwSpamSpy is our spam filter (free evaluation version available for download)
Anti-spam domain blacklist – list of domains that I refuse to receive mail from
Recent additions to domain blacklist (with whois details)
"419" scam sender/contact addresses ("Nigeria connection" address book)
DNS-based IP and domain name blacklists
IP address ranges
Dynamic IP addresses (700 KB!)
Name server / Registrar combinations
Free email providers
AOL dial-up address ranges and mail servers
How to trace senders of spam
Frequently asked questions (FAQ)
Lookup an IP address on blacklists (http://dnsbl.net.au/lookup/)

Clueless virus filters spam innocent third parties
Challenge and Response spam filters: A selfish idea for selfish times

ShareYourExperiences.com spammers
Smyrnagroup spammers (in German)
Kaplan College spam
Stock Price Manipulation Spam ("Pump & Dump")
What's the deal with "OEM software"?
'Phishing' for your wallet
Job spam for payment processors
Spam phone numbers ("diploma" spam, etc.)
"Joe job" information

Link exchange offer spam
Getting creative with spam
Link exchange spam: allcarpictures.com

Xenophobia, Spam and Viruses: The "German Spam" (Sober.H)
Sober.H – Racist German email spam spread by virus (in German)

"Joe job" against joewein.de
Porn spam: watchsound.com
Porn spam: hotsalza.com
Name servers used by spammers: joker.com
Rogue name servers: mediadreamland.com
Rogue name servers: airmaramba.biz
Rogue name servers: bonafidecash.com
Rogue name servers: maileasy.biz

Browser hijacking: heretofind.com

Computer Viruses